This is an old post and I have been struggling with this issue for a while trying to
understand my best options.
The only thing that can not be argued is that accepting "external to the application
session ids" has nothing to deal with "which is the path used for the session
cookie to be stored".
Let us take my personal problem to illustrate with a real example. A clustered environment
composed by apache using modjk to redirect the requests to a particular tomcat container:
1. Apache receives request http://domain/index.jsp
2. which is translated to http://domain/context/index.jsp
and requested to tomcat
3. If Tomcat has emptySessionPath="true" then the whole application works OK but
a given client could insert external cookies.
4. If Tomcat has emptySessionPath="false" then the application is protected
from external clients to set the session cookie but then any request missing the context
part of the URL will be considered part of a new session since the session cookie will be
stored in path="/context" instead of path="".
What we really need is:
A. No external cookies allowed.
B. Session cookies to be stored in path="/"
Am I missing something? Thanks in advance for any help!
View the original post :
Reply to the post :